Implement full Square payment review fixes + frontend polish

Implement every finding from the deep payment review (P0-P2, minors,
nitpicks), then close the post-implementation re-review items, then
align card-form typography and roll out the Square trust badge.

Backend - Square API alignment:
- tip_settings.allow_tipping nested under device_options (was top-level:
  terminal tips were silently lost in prod)
- CreateCardOnFile now accepts customerID and sends card.customer_id;
  saved-card (ccof:) charges forward square_customer_id as CustomerID
- New SquareClient methods GetPayment, CreateCustomer, CancelCheckout
- SCA verification_token accepted + forwarded in all charge paths
- ExpMonth/ExpYear -> *int; URL-path id validation; CancelCheckout
  NOT_FOUND-only no-op (dropped unverified NOOP); exported ErrorCode/
  ErrorDetail helpers; mock rejects raw PANs, RList locks, redacts
  emails, ForceRefundPending hook

Backend - money safety:
- sweepManualPendingSquareRefunds reconciles rows WITH square_refund_id
  instead of stranding them forever
- SweepStalePendingPayments reconciles at Square before failing (tri-state:
  leave pending on transport error, rescue completed, fail definitively)
- GetCheckoutStatus cancellation-recheck; terminal CANCELED resolution;
  SweepStaleTerminalCheckouts covers terminal_checkouts table
- till gift-card clawback on definitive failure incl. retry path +
  INSUFFICIENT_FUNDS/ADDRESS_VERIFICATION_FAILURE/TRANSACTION_LIMIT
- cross-user saved-card collision fixed (UNIQUE(user_id,square_card_id))
- customer provisioning (lazy, save-only); one-off/guest mint no customer
- discount preview/apply unified in discounts.go (global-milestone visible
  in preview, N+1 eliminated, redemption counter preserved on failures)
- webhook event_id dedup; refund loop dedup; stale comment fixes
- test-isolation t.Cleanup on committed sweep tests

Frontend:
- SCA tokenizeWithVerification across all charge flows (amount as
  major-units decimal), 5-min token-expiry re-tokenize, verification_token
  in request bodies
- PaymentModal synchronous double-click + zero/negative-amount guards
- till online-card UI wired to /api/admin/till/sale
- policyPopover generalised; new /privacy-policy route; consent checkbox
  copy + Square privacy link
- Square card iframe styled to app typography (Inter 14px, oklch tokens);
  mock form md:text-sm parity
- 'Secure payment powered by Square' badge on all 8 card-payment flows

Schema/docs: terminal_checkouts + square_customer_id + per-user card
constraint in init-script.sql; README migrations; P14 plan + backlog +
Technical Manual updated.

Includes 39 modified/new test files; full backend suite (25 pkgs),
-race on payments+square, and frontend build are green.

init-scripts/init-script.sql

@@ -684,6 +684,26 @@ CREATE INDEX idx_payments_created_at_status ON payments(created_at, status);
 CREATE INDEX idx_payments_payment_method ON payments(payment_method);
 CREATE INDEX idx_payments_payment_method_created_at ON payments(payment_method, created_at);
 
+-- =======================================
+-- TERMINAL CHECKOUTS TABLE
+-- =======================================
+-- Tracks in-flight Square Terminal checkouts per booking so a lost-response
+-- retry cannot create a second live checkout, and records the payment type
+-- the admin charged so GetCheckoutStatus records the payment with that type
+-- instead of hardcoding 'full'.
+CREATE TABLE terminal_checkouts (
+    checkout_id VARCHAR(64) PRIMARY KEY,
+    booking_id CHAR(12) NOT NULL REFERENCES bookings(id) ON DELETE CASCADE,
+    payment_type payment_type NOT NULL DEFAULT 'full',
+    status VARCHAR(20) NOT NULL DEFAULT 'PENDING',
+    amount NUMERIC(10,2) NOT NULL DEFAULT 0,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX idx_terminal_checkouts_booking ON terminal_checkouts(booking_id, status);
+CREATE INDEX idx_terminal_checkouts_status ON terminal_checkouts(status);
+
 -- =======================================
 -- LOYALTY REDEMPTIONS TABLE
 -- =======================================
@@ -1960,7 +1980,12 @@ $$ LANGUAGE plpgsql;
 CREATE TABLE user_saved_cards (
     id CHAR(12) PRIMARY KEY DEFAULT generate_user_saved_card_id(),
     user_id CHAR(12) REFERENCES users(id) ON DELETE SET NULL,
-    square_card_id TEXT NOT NULL UNIQUE,
+    square_card_id TEXT NOT NULL,
+    -- Square customer profile id (P14): populated lazily the first time the
+    -- user SAVES a card, then reused for every subsequent card save. NULL for
+    -- rows created before provisioning was introduced. One-off (non-save)
+    -- payments never mint a Square customer, so this stays NULL for them.
+    square_customer_id TEXT,
     brand TEXT NOT NULL,
     last_4 TEXT NOT NULL,
     exp_month INT NOT NULL,
@@ -1970,7 +1995,12 @@ CREATE TABLE user_saved_cards (
     deleted_at TIMESTAMPTZ,
     deleted_by CHAR(12) REFERENCES users(id) ON DELETE SET NULL,
     retained_until TIMESTAMPTZ,
-    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    -- Uniqueness is per-user: the same physical card saved by two users yields
+    -- two independent rows, so user B saving a card already on user A's account
+    -- can never mutate A's row (or revive A's deleted card). A response-lost
+    -- retry re-tokenizing the same card for the SAME user upserts via this key.
+    UNIQUE (user_id, square_card_id)
 );
 
 CREATE INDEX idx_user_saved_cards_user ON user_saved_cards(user_id);